Advanced Visualization and Lookups →hardMultiple ChoiceObjective-mapped

SPLK-1002 Advanced Visualization and Lookups Practice Question

Exhibit

Search command:
| inputlookup geo_lookup
| search src_ip="10.0.0.1"
| table src_ip, city, country

Error: "Error in 'inputlookup' command: Could not find lookup table 'geo_lookup'"

Refer to the exhibit. What is the most likely cause of this error?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The lookup definition [geo_lookup] does not exist in transforms.conf

The error 'Could not find lookup table' indicates that Splunk cannot find a lookup definition named 'geo_lookup' in transforms.conf. This is the most likely cause because the lookup definition (stanza) is missing or misconfigured. If the file geo.csv were missing but the definition existed, the error would mention 'file not found'. Permission errors produce a different message, and a misspelled field would not cause this error. Therefore, option A is correct.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The lookup definition [geo_lookup] does not exist in transforms.conf
Why this is correct
The 'inputlookup' command requires a valid lookup definition; absence causes this exact error.
✗
The lookup file geo.csv is not present in the lookups directory
Why it's wrong here
That would give a 'could not open lookup file' error.
✗
The field src_ip is misspelled in the lookup table
Why it's wrong here
The error occurs before field mapping is checked.
✗
The user does not have read permission on the lookup table
Why it's wrong here
Permission errors typically say 'you do not have permission'.

Go deeper

SPLK-1002 Advanced Visualization and Lookups Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question